This field now causes an exception on templates. The Metron model has a
timestamp field that is sufficient.

The semantics for string types have changed. In 2.x, index settings are either
"analyzed" or "not_analyzed" which means "full text" and "keyword", respectively.
Analyzed text means the indexer will split the text using a text analyzer, thus
allowing you to search on substrings within the original text. "New York" is split
and indexed as two buckets, "New" and "York", so you can search or query for
aggregate counts for those terms independently and match against the individual
terms "New" or "York." "Keyword" means that the original text will not be
split/analyzed during indexing and instead treated as a whole unit. For example,
"New" or "York" will not match in searches against the document containing "New
York", but searching on "New York" as the full city name will match. In
Elasticsearch 5.6 language, instead of using the "index" setting, you now set the
"type" to either "text" for full text, or "keyword" for keywords.

Below is a table listing the changes to how String types are now handled.